Splunk SPLK-1003 Online Practice Questions and Exam Preparation

Splunk SPLK-1003 Online Questions & Answers

• Question 21:

  Search heads in a company's European offices need to be able to search data in their New York offices. They also need to restrict access to certain indexers. What should be configured to allow this type of action?

  A. Indexer clustering
  B. LDAP control
  C. Distributed search
  D. Search head clustering
  C. Distributed search

  ---

  Explanation/Reference:

  The correct answer is C. Distributed search is the feature that allows search heads in a company's European offices to search data in their New York offices.Distributed search also enables restricting access to certain indexers by using the

  splunk_server field or the server.conf file1.

  Distributed search is a way to scale your Splunk deployment by separating the search management and presentation layer from the indexing and search retrieval layer. With distributed search, a Splunk instance called a search head sends

  search requests to a group of indexers, or search peers, which perform the actual searches on their indexes.The search head then merges the results back to the user2. Distributed search has several use cases, such as horizontal scaling,

  access control, and managing geo-dispersed data.For example, users in different offices can search data across the enterprise or only in their local area, depending on their needs and permissions2.

  The other options are incorrect because:

  A. Indexer clustering is a feature that replicates data across a group of indexers to ensure data availability and recovery.Indexer clustering does not directly affect distributed search, although search heads can be configured to search across an indexer cluster3.

  B. LDAP control is a feature that allows Splunk to integrate with an external LDAP directory service for user authentication and role mapping. LDAP control does not affect distributed search, although it can be used to manage user access to data and searches.

  D. Search head clustering is a feature that distributes the search workload across a group of search heads that share resources, configurations, and jobs. Search head clustering does not affect distributed search, although the search heads in a cluster can search across the same set of indexers.

• Question 22:

  What are the minimum required settings when creating a network input in Splunk?

  A. Protocol, port number
  B. Protocol, port, location
  C. Protocol, username, port
  D. Protocol, IP. port number
  A. Protocol, port number

  ---

  Explanation/Reference:

  https://docs.splunk.com/Documentation/Splunk/8.0.5/Admin/Inputsconf

  [tcp://:]

  *Configures the input to listen on a specific TCP network port. *If a makes a connection to this instance, the input uses this stanza to configure itself.

  *If you do not specify , this stanza matches all connections on the specified port.

  *Generates events with source set to "tcp:", for example: tcp:514 *If you do not specify a sourcetype, generates events with sourcetype set to "tcp-raw"

• Question 23:

  Which pathway represents where a network input in Splunk might be found?

  A. $SPLUNK HOME/ etc/ apps/ ne two r k/ inputs.conf
  B. $SPLUNK HOME/ etc/ apps/ $appName/ local / inputs.conf
  C. $SPLUNK HOME/ system/ local /udp.conf
  D. $SPLUNK HOME/ var/lib/ splunk/$inputName/homePath/
  B. $SPLUNK HOME/ etc/ apps/ $appName/ local / inputs.conf

  ---

  Explanation/Reference:

  The correct answer is B. The network input in Splunk might be found in the $SPLUNK_HOME/etc/apps/$appName/local/inputs.conf file. A network input is a type of input that monitors data from TCP or UDP ports. To configure a network

  input, you need to specify the port number, the connection host, the source, and the sourcetype in the inputs.conf file.You can also set other optional settings, such as index, queue, and host_regex1. The inputs.conf file is a configuration file

  that contains the settings for different types of inputs, such as files, directories, scripts, network ports, and Windows event logs. The inputs.conf file can be located in various directories, depending on the scope and priority of the settings. The

  most common locations are:

  $SPLUNK_HOME/etc/system/default: This directory contains the default settings for all inputs.You should not modify or copy the files in this directory2. $SPLUNK_HOME/etc/system/local: This directory contains the custom settings for all

  inputs that apply to the entire Splunk instance.The settings in this directory override the default settings2.

  $SPLUNK_HOME/etc/apps/$appName/default: This directory contains the default settings for all inputs that are specific to an app.You should not modify or copy the files in this directory2. $SPLUNK_HOME/etc/apps/$appName/local: This

  directory contains the custom settings for all inputs that are specific to an app.The settings in this directory override the default and system settings2. Therefore, the best practice is to create or edit the inputs.conf file in the $SPLUNK_HOME/

  etc/apps/$appName/local directory, where $appName is the name of the app that you want to configure the network input for. This way, you can avoid modifying the default files and ensure that your settings are applied to the specific app.

  The other options are incorrect because:

  A. There is no network directory under the apps directory. The network input settings should be in the inputs.conf file, not in a separate directory. C. There is no udp.conf file in Splunk. The network input settings should be in the inputs.conf file, not in a separate file. The system directory is not the recommended location for custom settings, as it affects the entire Splunk instance. D. The var/lib/splunk directory is where Splunk stores the indexed data, not the input settings. The homePath setting is used to specify the location of the index data, not the input data. The inputName is not a valid variable for inputs.conf.

• Question 24:

  In case of a conflict between a whitelist and a blacklist input setting, which one is used?

  A. Blacklist
  B. Whitelist
  C. They cancel each other out.
  D. Whichever is entered into the configuration first.
  A. Blacklist

  ---

  Explanation/Reference:

  https://docs.splunk.com/Documentation/Splunk/8.0.4/Data/Whitelistorblacklistspecificincomi ngdata "It is not necessary to define both an allow list and a deny list in a configuration stanza. The settings are independent. If you do define both filters and a file matches them both, Splunk Enterprise does not index that file, as the blacklist filter overrides the whitelist filter." Source:https://docs.splunk.com/Documentation/Splunk/8.1.0/Data/Whitelistorblacklistspecif icincomingdata

• Question 25:

  An organization wants to collect Windows performance data from a set of clients, however, installing Splunk software on these clients is not allowed. What option is available to collect this data in Splunk Enterprise?

  A. Use Local Windows host monitoring.
  B. Use Windows Remote Inputs with WMI.
  C. Use Local Windows network monitoring.
  D. Use an index with an Index Data Type of Metrics.
  B. Use Windows Remote Inputs with WMI.

  ---

  Explanation/Reference:

  "The Splunk platform collects remote Windows data for indexing in one of two ways: From Splunk forwarders, Using Windows Management Instrumentation (WMI). For Splunk Cloud deployments, you must use the Splunk Universal Forwarder on a Windows machines to montior remote Windows data."

• Question 26:

  A company moves to a distributed architecture to meet the growing demand for the use of Splunk. What parameter can be configured to enable automatic load balancing in the

  Universal Forwarder to send data to the indexers?

  A. Create one outputs . conf file for each of the server addresses in the indexing tier.
  B. Configure the outputs . conf file to point to any server in the indexing tier and Splunk will configure the data to be sent to all of the indexers.
  C. Splunk does not do load balancing and requires a hardware load balancer to balance traffic across the indexers.
  D. Set the stanza to have a server value equal to a comma-separated list of IP addresses and indexer ports for each of the indexers in the environment.
  D. Set the stanza to have a server value equal to a comma-separated list of IP addresses and indexer ports for each of the indexers in the environment.

  ---

  Explanation/Reference:

  Set the stanza to have a server value equal to a comma-separated list of IP addresses and indexer ports for each of the indexers in the environment. This is explained in the Splunk documentation, which states: To enable automatic load balancing, set the stanza to have a server value equal to a comma-separated list of IP addresses and indexer ports for each of the indexers in the environment. For example:

  [tcpout] server=10.1.1.1:9997,10.1.1.2:9997,10.1.1.3:9997 The forwarder then distributes data across all of the indexers in the list.

• Question 27:

  User role inheritance allows what to be inherited from the parent role? (select all that apply)

  A. Parents
  B. Capabilities
  C. Index access
  D. Search history
  B. Capabilities
  C. Index access

  ---

  Explanation/Reference:

  https://docs.splunk.com/Documentation/Splunk/latest/Security/Aboutusersandroles#Role_i nheritance https://docs.splunk.com/Documentation/Splunk/7.3.1/Security/Aboutusersandroles#How_users_inherit_capabilities

• Question 28:

  All search-time field extractions should be specified on which Splunk component?

  A. Deployment server
  B. Universal forwarder
  C. Indexer
  D. Search head
  D. Search head

  ---

  Explanation/Reference:

  Search-time field extractions are the process of extracting fields from events after they are indexed. Search-time field extractions are specified on the search head, which is the Splunk component that handles searching and reporting. Search-time field extractions are configured in props.conf and transforms.conf files, which are located in the etc/system/local directory on the search head. Therefore, option D is the correct answer. References: Splunk Enterprise Certified Admin | Splunk, [About fields - Splunk Documentation]

• Question 29:

  Which Splunk forwarder type allows parsing of data before forwarding to an indexer?

  A. Universal forwarder
  B. Parsing forwarder
  C. Heavy forwarder
  D. Advanced forwarder
  C. Heavy forwarder

• Question 30:

  How does the Monitoring Console monitor forwarders?

  A. By pulling internal logs from forwarders.
  B. By using the forwarder monitoring add-on
  C. With internal logs forwarded by forwarders.
  D. With internal logs forwarded by deployment server.
  C. With internal logs forwarded by forwarders.

  ---

  Explanation/Reference:

  Quoting the following Splunk URL reference https://docs.splunk.com/Documentation/Splunk/8.2.2/DMC/DMCprerequisites "Monitoring Console setup prerequisites. Forward internal logs (both $SPLUNK_HOME/car/log/splunk and$SPLUNK_HOME/var/log/introspection) to indexers from all other components. Without this step, many dashboards will lack data."